Top Risks

• proxy permission routes all browser traffic through developer-controlled infra with no accountability.
• Privacy policy URL returns fetch error — effectively no readable policy; scored as unfetched.
• Developer is free-webmail (gmail), no verified name, no verified publisher badge.
• Small install base (515) with high-impact permission is tail-attack-surface anomaly.
• No CSP declared; MV3 mitigates remote-eval but adds no content-security policy protection.

Evidence

• proxy_permission manifest proxy declared — can silently redirect all HTTP/HTTPS traffic; core VPN risk.
• privacy_policy_fetch_failed api myxavpn.com/privacy/ returned HTTPError; policy content unverifiable → scored +10.0.
• free_webmail_dev store Developer email asdro1905@gmail.com; no developer name; no verified publisher badge.
• small_install_high_perm api install_perm_anomaly: 515 installs + proxy (HIGH) — tail-attack-surface flag set.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• js_external_host crx Extension contacts myxavpn.com; same domain as unfetchable privacy policy.
• maintenance_3_6_mo store months_since_update=7 → +3.5 maintenance score.
• no_bad_hosts_no_cves api threat_intel bad_host_hits empty; cve_findings_raw empty; code_findings_raw empty.

Permissions Breakdown

• proxy high Full proxy control — can reroute all browser traffic through attacker-controlled servers.
• storage low Local key-value store; low standalone risk.

Pillar Scores

Bookkeeping